Over the last couple of years, I have done quite a lot of work with modifying and writing Lucee extensions for talking to different caching layers. This leads me to wonder why classes as fundamental as lucee.runtime.cache.tag.udf.UDFCacheItem are buried inside the lucee.lco core, rendering them inaccessible to the default JVM ClassLoader. That means that any cache extension or backend (1) attempting to perform deserialization will fail due to inability to find the class.
The issue was present but avoidable with Lucee 4. With Lucee 5 it is worse because of OSGI. I had to resort to reimplementing java.io.ObjectInputStream to allow passing of a non-standard ClassLoader as an argument during deserialization. Then, I noticed that the Memcached extension is benefiting from the same “fix”, since it was already implemented by the Whalin client library. On the other hand, the MongoDB extension has an open issue concerning support for non-primitive data types, which is presumably also ClassLoader-related.
I could be missing something, but it seems that a lot of issues and extra code could be avoided by a repackaging of critical classes. Any thoughts?
(1) The ability to deserialize objects stored in cache entries is fundamental to the operation of some persistence layers e.g. Apache Ignite.